RuntimeBroker.exe

Runtime Broker

Expected under a service host, in System32. Memory listings show its name cut short.

Normal Processes
Open it in the tree

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: svchost.exe (a value that published detection rules check for)Sources: Elastic: Unusual Parent-Child Relationship (opens in a new tab), Velociraptor: Windows.Attack.ParentProcess (opens in a new tab)Elastic's rule also accepts Workplace Container Helper.exe.
Path: System32 (a value that published detection rules check for)C:\Windows\System32\RuntimeBroker.exeSources: Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab), SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
Account: Read each copy's token on a clean machine of the same build, with Process Explorer live or windows.getsids in memory.
Session: Read each copy's SessionId with Get-CimInstance Win32_Process or windows.pslist on a clean machine of the same build.
Instances: Count copies per session on a clean machine of the same build, with the same apps open.
Starts: Compare each copy's start with the sign-in on a clean machine of the same build.
Command Line: Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By: Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Its name is long and unfamiliar, which makes a look-alike easy to miss. Its parent and its folder are fixed by public rules, so those are what to check.

What It Does

Microsoft Learn has no page for RuntimeBroker.exe, so its profile rests on detection rules. Elastic and Velociraptor expect a service host (svchost.exe) to start it, and Velociraptor and SigmaHQ expect it in C:\Windows\System32. The only other parent Elastic's rule accepts is Workplace Container Helper.exe. Its long, unfamiliar name makes a look-alike easy to miss, so read the name letter by letter. A copy started by anything else, or running from another folder, needs a reason.

Read which service host starts it, and its account, session and count, on a clean machine of the same build with the same apps open.

The kernel keeps 14 characters of a process name, so memory listings show it cut short, ending in the full stop of .exe. That is normal, not a misspelling.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

A name a letter away from RuntimeBroker.exe passes a quick look, while the name cut short in memory listings is normal.Misspelt and Look-Alike Names
Malware takes the name RuntimeBroker.exe and runs from a user folder, where the path, not the name, gives it away.Wrong Path

Red Flags

Each sign below links to the page that shows how to confirm it.

A creator other than svchost.exe, though Elastic's rule also accepts Workplace Container Helper.exe.Wrong Parent
Any folder but C:\Windows\System32.Wrong Path
A name a letter away from RuntimeBroker.exe, though a cut name in memory listings is normal.Misspelt and Look-Alike Names
A RuntimeBroker.exe with no valid signature, embedded or through a catalogue.Renamed, Unsigned or Falsely Signed Binaries

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	For a New Process Name ending in RuntimeBroker.exe, the Creator Process Name should be svchost.exe.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image, ParentImage and User for each copy.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FolderPath, InitiatingProcessFileName and AccountName for each copy.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Before you read no rows as clean, check that it recorded the genuine copy at a recent boot or sign-in. A hit is a lead, so check the file's signer and where it came from before you call it malicious.

KQLDefender XDR, Advanced hunting

// RuntimeBroker.exe outside C:\Windows\System32, or created by anything but svchost.exeDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "RuntimeBroker.exe"| where not(FolderPath matches regex @"(?i)^C:\\Windows\\System32(\\RuntimeBroker\.exe)?$")    or InitiatingProcessFileName !in~ ("svchost.exe")| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, CreatedProcessSessionId, InitiatingProcessFileName, InitiatingProcessFolderPath